MozDef: The Mozilla Defense Platform
Branch: master
Clone or download
pwnbus Merge pull request #1087 from darakian/fix-makefile-for-user-env
Actually working makefile with ENV file existence check and env variable setting for docker-compose command
Latest commit 4f061eb Feb 15, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
alerts Merge pull request #1090 from mozilla/update_summary_generic_deadman Feb 6, 2019
benchmarking Fixup block comments not having a space after hash Dec 14, 2018
bot Create .ini file for both slack and irc Feb 8, 2019
cloudy_mozdef fix SQS policy to only accept intra-account sendMessage Jan 31, 2019
config Merge remote-tracking branch 'origin/infosec_workweek' into virtualen… Oct 24, 2018
cron Fix API calls to use next_offset as this is the newer way to paginate Jan 30, 2019
docker Merge pull request #1094 from mozilla/sampledata_wait_elasticsearch Feb 6, 2019
docs Fix inline code markup in docs Jan 24, 2019
examples Fixup unused variables check Dec 14, 2018
loginput Fixup unused variables check Dec 14, 2018
meteor Merge pull request #1054 from mozilla/hostname-search Jan 15, 2019
mozdef_util Merge pull request #1071 from mozilla/add_plugins_field_events Jan 30, 2019
mq Project plugins key from mq plugins removing it Feb 8, 2019
rest removing unused route from Jan 8, 2019
static Remove heatmap html page Jun 15, 2017
systemdfiles Update python virtualenv path for service files Apr 20, 2018
tests Merge pull request #1090 from mozilla/update_summary_generic_deadman Feb 6, 2019
.flake8 Fixup unused variables check Dec 14, 2018
.gitignore add feature removal docs, update gitignore Nov 6, 2018
.travis.yml upgrade travis docker-compose as per… Oct 30, 2018 Modifying urls to point to mozilla from jeffbryner, slight readabilit… Jun 15, 2017
LICENSE Updated license file to conform with MPL Feb 25, 2014
Makefile Actually working with ENV file existence check and env variable setti… Feb 1, 2019 Setup default hosted CloudFormation templates Jan 10, 2019
requirements.txt Merge branch 'master' into squid_parsing Jan 31, 2019

Build Status Documentation Status

MozDef: The Mozilla Defense Platform


The inspiration for MozDef comes from the large arsenal of tools available to attackers. Suites like metasploit, armitage, lair, dradis and others are readily available to help attackers coordinate, share intelligence and finely tune their attacks in real time. Defenders are usually limited to wikis, ticketing systems and manual tracking databases attached to the end of a Security Information Event Management (SIEM) system.

The Mozilla Defense Platform (MozDef) seeks to automate the security incident handling process and facilitate the real-time activities of incident handlers.


  • Provide a platform for use by defenders to rapidly discover and respond to security incidents.
  • Automate interfaces to other systems like bunker, cymon, mig
  • Provide metrics for security events and incidents
  • Facilitate real-time collaboration amongst incident handlers
  • Facilitate repeatable, predictable processes for incident handling
  • Go beyond traditional SIEM systems in automating incident handling, information sharing, workflow, metrics and response automation


MozDef is in production at Mozilla where we are using it to process over 300 million events per day.

Give MozDef a Try in AWS:

Launch MozDef